1

I'm writing an iOS app that will store some information. Though not too confidential, I'd like to prevent other apps from reading the data, since a malicious app can then "phone home". If the user has jailbroken their phone, that would be their decision, so too if they will give someone else the device so the other person can use the app and see the data. My question is only about preventing a malicious app from reading the data and sending it to its creators.

I'm planning on saving the data in the cache folder. Does that make a difference?

1 Answer 1

2

No. All third-party iOS applications must have a sandbox, and the sandbox prevents direct access to any other app's data. Two apps from the same publisher can create a shared location that both can access, but even then, any data stored in an app's own directories is never exposed to other apps. Apps can also push data to one another, but there is no way for one app to force another to send it data unless the developer of the sending app explicitly creates one.

From Apple's File System Overview doc:

For security purposes, an iOS app’s interactions with the file system are limited to the directories inside the app’s sandbox directory. During installation of a new app, the installer creates a number of container directories for the app inside the sandbox directory. Each container directory has a specific role. The bundle container directory holds the app’s bundle, whereas the data container directory holds data for both the app and the user. The data container directory is further divided into a number of subdirectories that the app can use to sort and organize its data. The app may also request access to additional container directories—for example, the iCloud container—at runtime.

The Library/Caches directory for an app has the same privileges as any other app-specific folder. Its main distinction is that its contents are considered to not need backing up or to be disastrous if lost, though they are less ephemeral than temp data (which may be purged automatically while the app is not running). As such, files in the Caches directory are not synced to iCloud. You can also use the "do not back up" attribute for a file in any directory that should not be synced.

2
  • Does this remain true as of 2022? How does the built-in Files app can show content of other apps?
    – greatvovan
    Commented Jan 24, 2022 at 4:28
  • Built-in apps can of course have access to permissions not available to third-party apps, if Apple wills it so. I don't have an iOS device handy, but I also suspect that most app files aren't available to the Files app; apps are built with the assumption that nobody but themselves - not even the user (except on jailbroken devices) - can access them. Exposing it all could have very bad implications for a lot of third-party apps.
    – CBHacking
    Commented Jan 24, 2022 at 9:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .